In a resolute pursuit of its comprehensive AI strategy, Google appears to be employing a high-handed “act now, explain later” methodology. According to recent revelations by computer scientist Alexander Hanff, known pseudonymously as “The Privacy Guy,” the Chrome browser is surreptitiously downloading a concealed file, approximately 4GB in magnitude, in the background without the user’s consent or prior knowledge. This file comprises the quintessential weight data requisite for executing the Gemini Nano large language model (LLM) on-device. Such an endeavor has not only incited controversy regarding the misappropriation of local storage but may also infringe upon sensitive privacy regulations and environmental sustainability standards.
The contentious file, designated as weights.bin, serves as the core data fueling Chrome’s integrated AI functionalities, such as “Help me write” and localized fraud detection. Empirical verification by researchers and various media outlets has identified several profoundly controversial characteristics of this mechanism:
- Imperceptible and Mandatory: Chrome orchestrates the download and installation of this substantial 4GB file without presenting any notification or inquiring whether the user desires these AI features; notably, it lacks any “opt-in” mechanism.
- Deliberately Obscured: The file is sequestered deep within the Library directory of macOS or the hidden system folders of Windows, rendering it nearly invisible to the average user; furthermore, its generic nomenclature,
weights.bin, offers no indication of its true purpose. - Incessant Regeneration: Most disparaged is the fact that should a user identify and delete the directory containing the file, Chrome “automatically re-initiates the download” within minutes. To decisively terminate this behavior, a user must possess advanced technical acumen to navigate to
chrome://flagsand manually disable the relevant AI parametersβor alternatively, uninstall the browser entirely.
Alexander Hanff has vehemently condemned this evasion of user authorization, contending that such forced distribution and the difficulty of removal may violate stringent privacy frameworks, including Europe’s General Data Protection Regulation (GDPR).
Beyond the concerns of privacy and the right to information, this maneuver carries a staggering environmental toll. Hanff estimates that if Google distributes this 4GB file to a mere 15% of Chrome’s user baseβapproximately 500 million devicesβthe resulting data transmission alone would generate roughly 30,000 metric tons of CO2 equivalent (CO2e), a carbon footprint comparable to the annual emissions of 6,500 passenger vehicles. This figure accounts only for the inaugural transmission costs, excluding the cumulative electricity consumption of hundreds of millions of devices subsequently running the AI model locally.
At present, Google has not issued an official response regarding this incident.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.